Nuclear Engineering and Design 122 (1990) 387-399
North-Holland
387
A study of the dynamics of SECURE reactors: Comparison
of experiments and computations
Du~an Babala, Ulf Bredolt and John Kemppainen
A B B Atom AB, S-721 63 Viister~ts, Sweden
Pressurized Water Reactors designed according to the PlUS principle possess unique characteristics that make their safety
independent of the usual multitude of engineered safety systems, and virtually immune to human error during operation. A
basic feature of this principle is the self-protective thermo-hydraulics of the primary system that prevents core power from
exceeding the cooling capability of the submerging water, independently of outside surveillance and intervention.
This paper describes the experimental demonstration of the self-protective features of the primary system in a large scale
test loop in ABB Atom's engineering laboratories. The loop employs real time simulation of core power as a function of
coolant conditions in an electrically heated mock-up of a fuel assembly.
System responses to disturbances of various types and severity were studied. Comparisons were made with predictions by
the RIGEL code, which has been developed specifically for the study of PIUS-type reactors. Selected results are presented in
this paper.
The tests have demonstrated the self-protective thermo-hydraulics of the primary systems of Pressurized Water Reactors
designed according to the PIUS principle, and verified the capability of the RIGEL code to predict the dynamics of such
systems.
1. Introduction
In order to meet the steadily increasing safety requirements, m o d e m nuclear power Plants based on
Light Water Reactors (LWRs) have become very complex over the last 15-20 y. The increased complexity
has resulted in major increases in costs and construction
time.
By basing the reactor design on the P I U S (Process
Inherent Ultimate Safety) principle, safety from severe
accidents can be made a built-in characteristic of an
L W R primary system, independent of engineered safety
systems and virtually immune to human error or mischief. This makes it possible both to satisfy stringent
safety requirements and to substantially simplify the
plant design.
Employing the P l U S principle, ABB A t o m has introduced the S E C U R E pressurized water reactor concepts:
the S E C U R E (often designated S E C U R E - H ) reactor
for low temperature heat generation, e.g. district heating, and the P I U S reactor (previously also called
S E C U R E - P ) for electric power generation. S E C U R E
operates at the pressure of 2.0 MPa with 190°C core
exit temperature, while these values for P l U S are 9.0
MPa and 290°C, respectively.
0029-5493/90/$03.50
A design according to the P I U S principle follows
two basic rules, i.e.
(a) Keep the core submerged in water under all circumstances and
(b) Provide the primary coolant system with self-protective thermo-hydraulic characteristics such that the
core will not experience a level of heat generation
exceeding the cooling capability of the submerging
water.
Several P l U S type reactor designs have been described
in the literature, e.g. in refs. [1] and [2]. Examples of the
function of the self-protecting thermo-hydraulics in
transients as calculated by means of computer simulations are described in ref. [3]. The P l U S principle of
operation can be explained in the following way (fig. 1).
(la) A heat-generating nuclear core in a large water
pool is placed at the bottom of a vertical pipe, the riser.
A natural circulation flow is established.
(lb) The circulation flow is returned to the bottom
of the riser by means of a pump P. The generated heat
remains in the circulating water.
(lc) A steady state is reached by extracting as much
heat in a heat exchanger X (steam generator) as is
produced in the core. The water temperature is higher
in the circulation loop than in the surrounding pool.
© 1990 - E l s e v i e r S c i e n c e P u b l i s h e r s B.V. ( N o r t h - H o l l a n d )
388
D. Babala et al. / The dynamics of S E C U R E reactors
a
b
glC
t +,
r
e
d
r_ s
m
711Hr/-Fig. 1. (a-d) The principle of PIUS operation. P pump: X heat exchanger; L - lower thermal denisty lock; U - upper
thermal density lock; S - steam pressurizer. For details see
Introduction.
The hot water in the loop is in contact with the cold
water of the pool at two levels, at the bottom and at the
top of the riser. Since the hot water is above the cold
water, mixing between them is small; two h o t / c o l d
interfaces are formed. They are kept in place by controlling the rate of flow and the volume of the hot water.
The regions of contact are called the upper (U) and
lower (L) 'thermal density locks'.
(ld) A steam pressurizer S is added to facilitate the
pressure control. The riser extends into the pressurizer,
so that water is in contact with steam at two surfaces, in
the riser and in the pool.
Figure (ld) represents a schematic flow diagram of the
PIUS primary system. However, a steady-state operation of the reactor requires control by external devices.
The lower h o t / c o l d interface is kept in place by adjusting the speed of the recirculation pump (e.g.+ if the
interface tends to move upward, an increase in the
pump speed will push it down).
During startup, the lower density lock contains a
trapped gas bubble separating the loop from the pool.
The bubble is removed after a temperature difference
between pool and circulating water has been established.
The elevation of the upper h o t / c o l d interface is kept
constant by adjusting the total amount of water in the
loop. The water level at the top of the riser is defined by
the total volume of hot water. The water level on the
pool side of the pressurizer is kept constant by adding
or removing water from the pool. The system pressure is
controlled by means of an external steam supply. The
reactor power is controlled by adjusting the coolant
average temperature or the concentration of boric acid
in the recirculating water.
The safety of the system is independent of external
devices. The water in the pool contains neutron poison
(boric acid) in high concentration. The controllers keeping the h o t / c o l d interfaces in place are designed for
only a limited range of operation. Thus, above a certain
threshold, disturbances in the pressure balance between
the recirculation loop and the pool cause the pool water
to enter the loop through one of the density locks and
shut down the reactor. This happens, for example, after
a trip of the recirculation pump or after a loss of heat
sink.
An excessively high reactor power increases the temperature and buoyancy of the water in the riser and
pulls the pool water into the loop. The size of the pool
is designed to contain an amount of water sufficient for
one week's post-shutdown cooling of the reactor in the
complete absence of all cooling systems.
The thermo-hydraulic function and the transient response of the system during normal operation as well as
accidents have been tested at the ABB A t o m laboratories in an electrically heated mock-up (ATLE) of a
S E C U R E reactor. Computer simulations of the transients have been made before each test run in order to
predict the behaviour of the test loop in advance. After
the tests were carried out, new computations were made
in order to ensure that the initial conditions and disturbances (boundary conditions) were identical to the
measured ones.
The simulation of the transients was made by the
R I G E L code [4], a computer program developed in
ABB A t o m for dynamic analysis of S E C U R E / P I U S
reactors. The program is an important tool in the design
work due to its relative simplicity. For the simulations,
a nodal model of the A T L E loop was made comprising
the primary system, the pool and the intermediate cooling loops.
D. Babala et al.
full scale design, to ensure similarity in the driving
buoyancy force during a transient. The test loop and the
reactor operate with identical temperatures and system
pressures. A schematic diagram of the test loop is given
in fig. 2.
The 'reactor core' in the test loop is a full scale 8 × 8
electrically heated rod assembly, with uniform heat generation over the entire rod length. In the
SECURE/PIUS reactors, the pool and the primary
system water contain boron (in the form of boric acid).
In the test loop, the concentration of the boric acid is
simulated by the concentration of an easily measurable
indicator, such as a strong electrolyte (sodium sulfate)•
Thus, the electrical conductivity of the fluid (compensated for the temperature dependence) serves as a
measure of the boron concentration. The presence of
sodium sulfate made it necessary to use stainless steel
for many components of the loop. The concentration of
the sodium sulfate had to be kept very low, however,
since the difference in potential between the heated
A comparison between some of the test results and
calculations is presented in this paper. The aim of the
comparison is to verify the RIGEL code's ability to
predict the dynamic behaviour of the SECURE/PIUS
reactors.
2. The ATLE test loop
To verify the computational methods and to demonstrate the self-protective thermo-hydraulics of the
SECURE/PIUS type reactors, a mock-up of a SECURE
reactor was built in the ABB Atom's engineering laboratory.
The volume scale of the mock-up is 1 : 308 of a real
SECURE reactor (there are 308 fuel assemblies in a
SECURE core). The mock-up consists of a pool, primary
system, pressurizer, heat exchangers, and intermediate
loops. The height of the test loop is the same as in the
!@
. . . . .
389
/ The dynamics of S E C U R E reactors
]
80]]er
THE ATLE TEST RIG
Ventupl
Heat Load
)non b r e a k e r s
'K522
Intermediate
Cooling Circuit
t
KB~I
i
Rec]rcula£
Dumps~6R]
Heat Exchangers
q
Riser
K528
,
Oowncomem
K803~
K802
qeactor
Pool
K322
i
'I~eactivit,~
Control"
Control?
valve
Intermediate
Cooling Circuit
~'Heat
Load
"Reactor
Core"
Thyr ] s t o r ~
Rect 1f i e r s ;
,
'
,
6 kV q
©
K5~O~",~K521 w
._~-4Lower
,
IDenslty
,
< LOCk
\K308:
"\K519
"Boron StorageI 1
Pump
10 kW
•
Na2S04
,,Ka#~
C]ean Water" rum D
(~keup
'Boron"
K539
i
,
i
.
,
.
\
--@
•
"
Fig. 2. The ATLE test loop.
I, ii, '0
Water
390
D. Babala et al. / The c6,namics of S E C U R E reactors
element and the pressure vessel led to a production of
oxy-hydrogen gas.
The supply of DC current from a static converter to
the rod bundle is controlled by a point reactor kinetics
model running in real time on an A S E A - M A S T E R
process computer. The point kinetics model simulates
neutron kinetics and heat conduction in the fuel. The
inlet and outlet temperatures, boron concentrations and
voids from the core are used as input data for the
model. The mean fuel temperature is calculated by the
model. Reactivity is a function of the moderator temperature, fuel temperature, boron concentration and
void (if any).
From the simulated nuclear fuel assembly the water
flows upward through the riser. In the upper part of the
riser, the Upper Thermal Density Lock ( U T D L ) connects the riser to the pool via a pipe filled with pool
water.
The free surface of the primary system is in contact
with steam in the pressurizer. The pressurizer volume is
connected to the pool both directly and via the upper
thermal density lock. The steam supply to the pressurizer is generated in an electrically heated boiler.
On its way from the upper end of the riser, the water
is divided into two flow paths through heat exchangers
and recirculation pumps. Downstream of the pumps,
the two flow paths converge to the downcomer. The
water flows downwards to the lower plenum just below
the inlet orifice to the rod bundle. The lower plenum is
connected to the pool via the Lower Thermal Density
Lock (LTDL).
The mock-up also includes the intermediate cooling
loops and the possibility to change the power load in a
specified way. In each intermediate cooling loop, water
circulates through the secondary side of the heat exchanger, water pump and a cooler (marked 'heat load'
in fig. 2). The flow and temperature of the cooling water
are constant. However, the water temperature at the
inlet to the secondary side of the heat exchanger can be,
in a limited range, controlled by the amount of water
bypassing the cooler ('Control valve' in fig. 2).
In the same way as in a real S E C U R E , the A T L E
loop includes control systems, (fig. 2). The h o t / c o l d
interface level in the L T D L is controlled in the loop C1.
The level is a function of the density difference between
the pool and the riser and the pressure drop in the riser
and the core, dependent on the pump revolution rate.
The h o t / c o l d interface level is determined from the
measured average temperature along the density lock
(K519-K521). The calculated level is compared with a
set point value and the difference is processed in a PI
controller. The output signal is used in a static frequency
converter which controls the feed frequency of the
power supply to the pump.
The h o t / c o l d interface level in the U T D L is controlled in the loop C2. The level is a function of the
mass inventory in the primary system. The position of
the h o t / c o l d interface is determined from the measured
average temperature along the density lock (K522
K524). The calculated position is compared with a set
point value and the difference is processed in a PI
controller. When the interface level is low, the output
signal activates a discharge valve. If the level is too high,
the signal causes the reactivity control system to inject
water into the loop (without changing the boron concentration in the latter).
The water level in the pressurizer is controlled in the
loop C4. In PIUS, level on the pool side is controlled.
For practical reasons, in A T L E the water level on the
riser side was chosen as input to the controller. Since
the two levels are hydrostatically coupled, there is no
difference in principle between the two ways of control.
The water level in the riser is indirectly a function of the
mass inventory in the pool. Actual water level is determined by a dp-meter (K401). The calculated level is
compared to a set point value. An o n / o f f controller
controls a discharge valve in the pool. The valve is
closed if the actual water level is below the set point
value.
The pressure is controlled in the loop C5. The measured pressure in the pressurizer (K101) is compared to
a predetermined set point value. The difference is
processed in a PI controller. The output signal controls
the electric power to the boiler.
The 'reactor' power is controlled in the loop C3. The
reactivity control system consists of a thermometer at
the core outlet, a 'clean-water' pump and a 'boratedwater' pump. The measured water temperature at the
core outlet (K528) is compared to a set point value. The
difference is processed in a specially designed P controller. The output signal from the controller controls
both the clean-water pump and the borated-water pump.
The boron content of the mixture injected to the primary
system is a predetermined function of the core outlet
temperature. A decrease in the temperature causes an
injection of water with reduced boron concentration, to
raise the reactor power. It has to be emphasized that all
control devices are designed to aid in operation of the
system, not to ensure its safety, which is totally independent of such devices.
The test loop is equipped with several thermometers,
mass flow meters, dp-cells, absolute pressure gauges and
conductivity meters. More than 200 measuring points
are available for recording. The maximum sampling
391
D. Babala et al. / The dynamics of S E C U R E reactors
sophisticated modelling. As illustrated in this paper, the
present level of modelling detail allows us to predict the
behaviour of the physical system with good confidence.
The code is in constant development.
In RIGEL, the hydraulic network is divided into a
number of fluid cells (volumes) interconnected by fluid
junctions. In both types of nodes, thermal equilibrium
between phases is assumed. The basic variables integrated in a fluid cell are the pressure, specific enthalpy
and boron content of the fluid. In fluid junctions, one
integrates mass flow, energy flow and boron flow. In
parts of the network where no heat transfer occurs and
where the fluid is known to be in a single phase, one
can opt for a special modelling of non-dissipative propagation of temperature and boron fronts.
Heat transfer is modelled by heat capacity cells and
heat flow junctions, where the energy and energy flow,
respectively, are integrated over time. A number of
different correlations for heat transfer can be selected.
Special node models are provided for the pressurizer
and the density locks, where the fluid phases, or fluids
at different temperatures, are stratified. Further, separate models are provided for pumps and controllers.
frequency is 10 Hz which is rapid enough even for fast
transients such as a power grid disturbance.
3. The RIGEL code
The design of a new unique system such as
SECURE/PIUS required, in the initial phase of development, an assessment of a large number of alternatives. The need for extensive parameter studies of the
system dynamics implied the necessity of a compromise
between the modelling detail and the speed of computation. A special computer program, RIGEL, was developed for that purpose [4]. Initially, the emphasis in the
RIGEL program was on the speed of computation,
without an undue sacrifice in accuracy, and on the
flexibility to accomodate design changes. The flexibility
of the program means not only a versatile input, but
also the ease of incorporating newly defined physical
models to the existing program structure.
As the optimal PIUS and SECURE designs crystallized, the emphasis in RIGEL gradually shifted to more
D A S H E D LINES = I N P U T / O U T P U T SIGNALS TO/FROM CONTROLLERS
I
PRESSURIZER
,-
.
.
.
.
G:_ f-__
LEVEL
PUMP 1
INTERMEDIATE LOOP 1
~4'
J
PUMP2
I
I
I
I
I
I
LOCK (UTDL)
--
--
--
INTERMEDIATE
I LOOP 2
"1
DOWNCOMER
WATER
PUMP
•
I
I
I
.....
T
i
_(~).L
. . . . . . . . . .
{ .............
I
I
I
I
-J
*
I
I
I
I
,
i
LOWER P L E N U M
L- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
LOWER T H E R M A L
DENSITY LOCK (LTDL)
Fig. 3. Nodalization of the ATLE loop.
.J
392
D. Babala et aL / The dynamics of S E C U R E reactors
The neutron kinetics is represented by a point kinetics
model.
The set of ordinary differential equations is integrated in time by a semi-implicit numerical method
[4].
4. The RIGEL representation of the ATLE test loop
The model of the primary system contains the reactor core, the riser, the pressurizer, the recirculation
loops with their pumps and heat exchangers and finally
the downcomer and the inlet plenum (fig. 3).
The reactor core is divided into four fluid cells and
four fuel cells (not shown in the fig.). Reactivity effects
of fuel and coolant temperatures, void and boron concentration (i.e. conductivity) are taken into account.
The pool, i.e. the pressure vessel which contains a
highly conductive cold water, is divided into a number
of fluid cells interconnected by fluid junctions. The
primary system is connected to the pool through the
two thermal density locks and via the pressurizer. The
recirculation pumps and the pump motors are modelled
separately. Each heat exchanger is modelled as two fluid
cells connected by heat flow junctions via the intervening walls (heat capacity cells). The heat transfer coefficients are flow dependent.
The secondary system, i.e. the intermediate cooling
loops, are modelled as boundary flow junctions connected to the secondary sides of the two heat exchangers, with prescribed inlet water temperatures.
The model of the control system covers the control
of the hot/cold water interface levels in the two thermal
density locks (loops C1 and C2), the water level in the
pressurizer (loop C4), the pressure control in the pressurizer (loop C5) and the reactivity control system (loop
C3).
was then exposed to identical disturbances as in the
ATLE loop.
The results from each test and from the corresponding simulation were plotted together on the same diagram for the final analysis and comparison. The broken
lines in each plot indicate the test results, while the full
lines show computed values.
One of the variables of interest is the mass flow rate
through the lower density lock. It is important to predict correctly how fast the lock is penetrated after a
disturbance. Other interesting variables are the boron
concentration in the core, reactor power and the outlet
water temperature. The first two tests (load following,
power grid disturbance) demonstrate the normal operation of a S E C U R E / P I U S reactor. The remaining three
tests (pump trip, loss of heat sink, uncontrolled boron
dilution) illustrate the response of the reactor to severe
disturbances that in a conventional PWR would require
intervention by safety systems.
5.1. P o w e r control
Changes in power demand on the primary system
during normal operation were simulated by varying, in
a prescribed manner, the water temperature at the inlets
to secondary sides of the heat exchangers. The measured temperature served as input to a PI-controller
steering the by-pass valve in each intermediate loop.
The set-point temperatures for the controllers were
raised linearly for 750 s, then kept constant for 1200 s,
and finally brought back to their original values in 750
s. The changes in temperatures corresponded to a - 30%
°il
.
5. Comparison of ATLE tests and RIGEL calculations
The test results from some of the transients performed in the ATLE loop have been compared to
computer simulations by the RIGEL program. Representative transients have been selected in order to examine the capability of the RIGEL code to predict
different events in the dynamic behaviour of the loop
both during normal operation and accidents.
The actual starting steady state conditions in individual tests were used as input to the computer simulations. The calculated steady state solution for the model
-
-
COMPUTED
........
i
.
.
.
.
.
MEASURED
i
i
L
i
.
(13
0
0
' 50 b
'
1 0 0' 0
t5 b 0
TIME
.
2 0. 0 0
(S)
.
.
2 5 0. 0
.
3000
Fig. 4. Reactor power during load following.
t
_
D. Babala et aL / The dynamics of SECURE reactors
-
-
COMPUTED
........
393
--COMPUTED
MEASURED
d
:I . . . . . . . . . . . . . .
J
i
........
i
t
i
i
MEASURED
i
i
I
i
L
(D
DOVN
/ COMER
•
toxl"
~ ,
Od"
~ ' ,
~o
5oh
~obo
~ 5 0. 0
. 2 0.0 0 . 2 5 0 0
TIME
LTDL
o
3obo
1o
20
Fig. 5. W a t e r temperature at the core outlet during load
4b
3o
TIME
(S)
5b
6;
(S)
Fig. 7. R e s p o n s e of water flows to a power grid disturbance.
following.
variation in the power load. All controls (C1-C5) were
active.
The transient starts with a rise in the controlled
water temperature in the intermediary loops. The resulting decrease in the heat outflow from the primary
system causes the core outlet temperature to rise,
activating the reactivity control system. Borated water is
injected into the loop, depressing the reactor power. The
reactivity control system (C3) keeps the variation of the
core outlet temperature small.
Computed results are compared to the measured
ones in figs. 4-6. The overall agreement is good during
--COMPUTED
i
h
......
t
i
i
t
i
MEASURED
i
i
~
~
_
the entire transient, although the computed values tend
to anticipate the measured ones.
5.2. Grid voltage disturbance
The PIUS reactor under normal operation should
tolerate smaller disturbances in the grid power supply,
without unnecessary and time-consuming shutdowns. A
typical grid disturbance that a power plant in
Scandinavia is required to withstand without disconnection from the grid, is a total loss of voltage lasting 0.25 s
followed by a full recovery in 0.5 s. The temporary loss
of power affects the recirculation pumps, with the ensuing disturbance in the hot/cold interface in LTDL. The
o
-
-
i
t
COMPUTED
t
t
.......
i
t
t
~
MEASURED
~
i
J
t-
O~
cU
(2)
E
u
oJ
/ '",
,'
,
2
tD_
o,
50 b
1 0 0' 0
1 5 0' 0
TIME
20 b 0
2 5 0' 0
3 0 0' 0
(S)
Fig. 6. Electrical c o n d u c t i v i t y of water at the core inlet during
load following.
:1
n0
~b
2b
3b
TIME
4b
5b
sb
(S)
Fig. 8. W a t e r t e m p e r a t u r e at the core outlet during a power
grid disturbance.
394
D. Babala et al. / The dynamics of S E C U R E reactors
--COMPUTED
........
J
i
~
i
i
-
MEASURED
i
J
i
t
-
i
L
COMPUTED
i
i
.......
i
J
i
MEASURED
i
i
i
i
0
0
~
-
,
____~:w77_
' . . . .
,,
__
, .....
_ . . . . . . . . . . .
_
°1
OO
o
lb
2b
3b
TTME
Fig.
9.
4b
5b
o
6b
4;
ad
do
TIME
(S)
Reactor power during a power grid disturbance.
1~o
2do
(S)
Fig. 11. Water temperature at the core outlet following a pump
trip.
response is strongly damped and the interface level
swings only once above and once below its steady state
value. The L T D L is designed to accomodate the anticipated changes in the interface level, without being
penetrated by the pool water. We have selected the
duration of the loss of power to be 2.1 s - sufficiently
long for a small amount of borated water to enter the
primary loop. All controls were active. The excess boron
has been subsequently automatically diluted by the
reactivity control system. The full-power operation of
the reactor remained undisturbed.
Computed and measured results are shown in figs.
7-9. The computed response of the system to the disturbance is faster and smaller than the measured one,
probably due to insufficient detail in modelling the
built-in control systems in the frequency converter of
the power supply to the recirculation pumps. The overall agreement with the measured response is good.
5.3. Recirculation p u m p trip
The trip of the recirculation pumps causes a rapid
shutdown of the reactor. A natural circulation of highly
borated water is established between the pool and the
riser, via the thermal density locks. The function of the
controllers in this transient is unimportant. In its consequences, the pump trip is equivalent to a total loss of
grid power.
--COMPUTED
i
......
--COMPUTED
i
i
t
t
MEASURED
i
i
t
t
I
i
b
i
MEASURED
i
o
E
U
%
2
to
~z
46
°o
44
84
do
TIME
do
2~o
(S)
Fig. 10. Water flow through LTDL following a pump trip.
a4
do
TIME
do
2do
{S)
Fig. 12. Electrical conductivity of water at the core inlet
following a pump t r i p .
395
D. Babala et aL / The dynamics of SECURE reactors
o
!,
(E5
........
- - C O M P U T E D
i
~
l
,
i
i
i
MEASURED
i
i
i
_
- - C O M P U T E D
i
i
i
('~lOd
i
........
I
.-..-
...
~
MEASURED
I
I
I_
o_
oJ
o_
tD-
.--
-
,."
',/',
/-
i
~o
o
0
4
40
BO
TTME
1~0
260
The transient starts when the power to the recirculation pumps is shut off. The decrease in the pump
revolution rate causes an inflow of highly conductive
pool water through the lower thermal density lock, due
to the disturbance in the pressure balance between the
riser and the pool. Figure 10 shows the mass flow rate
through the lower thermal density lock. The overall
agreement between calculated and measured flow rates
is good. However, after the peak in flow through the
density lock, one can observe a temporarily faster decay
of the predicted flow.
This discrepancy is probably due to the fact that the
heat stored in the structural components was neglected
in computations. The model predicts a faster decrease
of the water temperature in the riser (fig. 11). The mass
flow rate through the lower thermal density lock is at
this moment a function only of the temperature distribution in the riser. Therefore, the mass flow decays
faster in the simulation than in the test.
The conductivity in the core starts to rise when the
lower thermal density lock is penetrated. Figure 12
shows the increase of conductivity in the lower plenum.
The agreement between simulations and test data is
very good. A comparison between the measured and the
predicted reactor power shows a good agreement. However, after about 30 s, the predicted power decays
somewhat faster than the measured one (fig. 13).
5.4. Partial loss o f heat sink
Od
[
~0
I
,
200
I
'
I
400
'
600
TIME
I
,
I
800
1000
(S)
Fig. 14. Water temperature in the reactor core after a partial
loss of heat sink.
tor (PIUS) or a pump trip in the intermediate cooling
loops (SECURE).
The transient starts when the power supply to one of
the intermediate cooling loop pumps is shut off. The
heat extracted from the primary loop decreases rapidly
and a hot water front starts propagating along the
downcomer. When the hot water reaches the core region
(fig. 14), the pressure balance between the hot riser and
the cold pool is affected. The LTDL is penetrated and
the borated pool water starts flowing into the loop (fig.
15). The inflow of borated water is intermittent, until
the pump controller (C1) restores a stable h o t / c o l d
interface in the LTDL. The system response is oscilla-
f"3_
- - C O M P U T E D
i
i
i
i
. . . . . .
i
i
i
MEASURED
i
i
i_
ffJ.
i
5
2
(D
V
I
~ob
v
4oh
TIME
A loss of heat sink involves a fast decrease in the
power load due to e.g. an isolation of the steam genera-
-
';Ni.ET-
(S)
Fig. 13. Reactor power following a pump trip.
. . . . . . . . . . . . . . . . . . . . . . . . .
"
I
sob
Bob
lobo
(S)
Fig. 15. Water flow through LTDL following a partial loss of
heat sink. The flow meter shows the absolute value of the flow.
396
D. Babala et al. / The dynamics of S E C U R E reactors
--COMPUTED
b
,'L
i
MEASURED
i
flow regime in L T D L during oscillations, the error in
the computed final state is not excessively large.
A total loss of heat sink, i.e. a loss of power supply
to both cooling loop pumps, leads to a strong ingress of
borated water into the primary loop, shutting the reactor down.
b
,,,,
E
L)
5.5. Uncontrolled boron dilution
%
OJ
LO_
o
~00
400
600
Bob
1 0 0 0
(S)
TIME
Fig. 16. Electrical conductivity of water at the core inlet after a
partial loss of heat sink.
tory, with damped oscillations of a period equal to the
recirculation time (figs. 14-17). The amplitudes of oscillations are very sensitive to the exact mechanism of
dissipation of the circulating boron and temperature
fronts.
After the oscillations die out, the system reaches a
new steady state at a lower power. Since only two
controllers are active (C1 and C5), the final state depends only on the total amount of boron that entered
the primary loop. In the absence of feedback, the disagreement between measured and computed final states
depends on the accumulated error in the integrated
water flow through LTDL. Considering the complicated
We studied the response of the primary system to an
uncontrolled injection of clean water. The reactivity
control system (C3) was switched off and the bypass
control valves in the intermediary loops were closed
during the entire transient. The total amount of clean
water injected is normally limited by the size of clean
water storage vessels for the plant. The disturbance
corresponds to an unmonitored control-rod withdrawal
accident in a conventional PWR.
The behaviour of the system can be divided into
three phases, namely:
- The dilution phase, 0 - 3 0 0 s. Boron in the primary
system is continuously diluted and the reactor power
increases.
- T h e boration phase, 300-1500 s, Due to-the increased water temperature in the riser, the L T D L is
penetrated. The mean value of boron concentration
in the loop stays approximately constant, due to the
intermittent inflow of highly borated water from the
pool. The power oscillates around a constant mean
value.
- The recovery phase, 1500 s. Clean water storage
vessels are exhausted. Oscillations cease and a stable
steady state is reached at a lower power level.
0
J
oo--COMPUTED
i
i
--
i
~
i
i
-
i
MEASURED
i
i
t
i
~
i
i
L
i
J
CLI
i
J_
o
o
OJ-
o
oo_
OD
ot
o
CO
I
I
I
I
o
3-
ILUTION
0
0
i
200
400
TIME
60~3
(S)
80~3
Fig. 17. Reactor power after a partial loss of heat sink.
1000
BORATION
'
0
400
0
80
I
1200
TIME
,
RECOVERY
I
~600
(S)
,
I
2000
I
2400
Fig. 18. The three phases of an uncontrolled boron dilution
(measured reactor power).
D. Babala et aL / The dynamics of SECURE reactors
~
-
COMPUTED
~
oo]
i
i
l
. . . . . . . .
i
i
L
i
i
-
MEASURED
i
i
i
J
-
397
. . . . . . . .
COMPUTED
h
i
i
MEASURED
i
_
123-
OUTLET ~AAAAAAAAAAA-,~
!m ~ i ~ i o, ~ i ! i / ' V '" "i ;J ': ',, ',~ '~' :' ',' " " " " " ' " '
,
,,
h
,
"
"
,
,'
,~
t
',
h
q
',
~ Z / ' ", •" ~ ', , , , ,,, ,,' ,, ~', " . ;
~o
,,
't
"
h
'
, ,,
I"
CD
o
400
~o
TIME
800
(S)
1200
Fig. 19. Water temperature in the reactor core during an
uncontrolled boron dilution•
T h e three phases are illustrated o n the plot of the
recorded reactor power (fig. 18). In figs. 1 9 - 2 2 , the
predicted response of the system during the first two
phases is c o m p a r e d to the m e a s u r e d one. T h e onset of
the third phase depends, of course, o n the capacity of
the storage vessels for clean water.
5.5.1. The dilution phase, 0 - 3 0 0 s
T h e transient starts w h e n the o p e r a t o r (mistakenly
or maliciously) disables the reactivity control a n d
switches on the clean water p u m p to its m a x i m u m
possible flow rate. T h e injection of cold water into the
-
-
COMPUTED
. . . . . . . .
'4oh
o
'8oh
' 12bo
(S)
TIME
Fig. 21. Water flow through LTIgL during an uncontrolled
boron dilution. The flow meter shows the absolute value of the
flow.
p r i m a r y system causes a t e m p o r a r y decrease of the
water t e m p e r a t u r e in the core.
T h e h o t / c o l d interface level in L T D L is lowered due
to the d i s t u r b a n c e in the pressure b a l a n c e between the
riser a n d the pool. The L T D L control system C1 suppresses the recirculation p u m p revolution rate to compensate for the new t e m p e r a t u r e distribution in the
riser.
Figure 19 shows the core inlet a n d outlet water
temperatures. T h e small discrepancy in the core inlet
t e m p e r a t u r e s is constant, due to a n initialization error
of the core inlet t e m p e r a t u r e during the steady state
calculation of the loop.
MEASURED
l
i
COMPUTED
.
~
I
~
. . . . . . . .
i
~
l
h
i
MEASURED
L
l
=
o
%
O_
O.
'4oh
'8oh
TIME
(S)
'
12bo
Fig. 20. Electrical conductivity of water at the core inlet during
an uncontrolled boron dilution.
0
'400
'800
TIME (S)
' 1200
'
Fig. 22. Reactor power during an uncontrolled boron dilution•
398
D. Babala et al. / The dynamics of S E C U R E reactors
The boron concentration in the primary system decreases during this phase. Figure 20 shows the core
outlet water conductivity.
At the beginning, boron is diluted stepwise. The
length of the step is equal to the recirculation time of
the loop. After about four round trips the sharp concentration front has dissipated due to turbulent mixing.
A comparison between test results and calculated
ones shows an excellent agreement both in magnitude
and in attenuation of the boron front.
The flow through the LTDL is almost zero during
this phase of the transient (fig. 21). The reactor power
increases in response to the boron dilution and, to a
smaller degree, to the variation of the inlet water temperature (fig. 22). The total increase in reactor power is
limited by the maximum pump revolution rate. A comparison of measured and computed power also shows a
very good agreement.
A comparison of test results with the calculated
behaviour of the system also shows a good overall
agreement for this phase. However, there are some
discrepancies, mainly in the amplitude of oscillations.
The predicted amplitudes are lower, due to an underestimated flow through LTDL (fig. 21). Too low water
flow through LTDL leads to too small boration of the
primary system, which in turn implies too small oscillations in the predicted water temperature and the reactor
power. The underestimated boron inflow also implies
that the equilibrium between the inflow of clean and
borated water is reached at a higher mean power level.
The predicted oscillations grow slower than the measured ones - they are stable only after 1200 s, compared
to about 800 s measured. In other PIUS designs, the
oscillations stabilize much earlier [3].
6. Summary and conclusions
5.5.2. The boration phase, 3 0 0 - 1 5 0 0 s
When the pump revolution rate has reached the
upper limit of the control range, further increase of the
temperature in the riser causes the hot/cold interface in
the LTDL to move upwards.
At about 350 s the LTDL is penetrated and an
inflow of cold highly conductive water starts. The inflow is intermittent with the period equal to the recirculation time for the loop. The conductivity rises each
time an inflow from the LTDL occurs (fig. 20). The
inflow of water stops whenever the temperature in the
riser falls due to the fast power decrease (caused by the
highly conductive water reaching the core).
The conductivity of the water in the core continues
to decrease, but at a slower rate. The decrease in the
mean conductivity is caused partly by the injection of
clean water, partly by the fact that the plug of highly
borated water injected through LTDL is shorter than
the recirculation path of the loop.
The minimum conductivity of clean water pockets
finally levels off due to the turbulent diffusion from the
plugs of highly conductive water.
An equilibrium state is now reached between the
injected clean water and the highly conductive water
sucked through the LTDL.
At this time the reactor power has reached its maximum value. A new state of the loop is reached with an
almost constant power amplitude oscillation (fig. 22).
The calculated average fuel temperature (for the
SECURE design that ATLE simulates), initially 420 ° C,
rises to the mean value of 490 ° C, still safe by a wide
margin.
We have compared the results of simulations made
by the RIGEL code with the results of a number of
tests in the ATLE loop. Transient behaviour during
both small and large disturbances was studied. The
comparisons show a good agreement both in magnitude
and time of occurrence of different physical events. The
observed discrepancies are mainly due to limitations in
the RIGEL code to accurately predict: (i) the propagation of temperature and boron fronts, (ii) the complicated flow regime in the LTDL during oscillations.
The computed results differ by less than ten per cent
from the measured ones, even though the nodalization
of the ATLE loop is relatively coarse. The average node
volume in the primary loop is about four per cent of the
total volume of the primary system.
From our results, in part presented above, we conclude that
(a) During normal operation, a S E C U R E / P I U S reactor, as represented by the ATLE loop, is stable with
respect to minor disturbances, and has a good loadfollowing capability.
(b) The response of the ATLE loop to major disturbances confirms the expected self-protective
properties of the S E C U R E / P I U S type of primary
reactor system.
(c) The RI G EL code is a suitable computational aid for
simulating the dynamics of the ATLE loop. Since
the construction of the loop is in principle similar to
the design of an actual S E C U R E / P I U S primary
system, we are confident that the dynamics of the
latter can be predicted by the RIGEL program-with
an acceptable error.
D. Babala et al. / The dynamics of S E C U R E reactors
References
[1] C. Sundqvist and T. Pedersen, PlUS the forgiving reactor,
Modern Power Systems (Oct. 1985) 69-79.
[2] K. Hannerz, The PlUS PWR, Energia Nucleare (Rome) 4
(2) (1987) 10-21.
399
[3] D. Babala and K. Hannerz, Pressurized water reactor inherent core protection by primary system thermohydraulics, Nucl. Sci. Engrg. 90 (1985) 400-410.
[4] D. Babala, A fast semi-implicit integration method for
thermohydralic networks, Trans. Am. Nucl. Soc. 47 (1984)
295-7.